9.8

CVE-2026-64397

ksmbd: serialize QUERY_DIRECTORY requests per file

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: serialize QUERY_DIRECTORY requests per file

smb2_query_dir() stores a pointer to its stack-allocated private data in
the ksmbd_file readdir_data. Concurrent QUERY_DIRECTORY requests using the
same file handle can overwrite this pointer while an iterate_dir() callback
is still using it, resulting in a stack use-after-free.

Add a per-file mutex and hold it while accessing the shared directory
enumeration state. The lock covers scan restart, dot entry state,
readdir_data setup and iteration, and response construction. This prevents
another request from replacing readdir_data.private before the current
request has finished using it and also serializes the shared file position.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 5.15 < 6.1.178
Linux ≫ Linux Kernel Version >= 6.2 < 6.6.145
Linux ≫ Linux Kernel Version >= 6.7 < 6.12.96
Linux ≫ Linux Kernel Version >= 6.13 < 6.18.39
Linux ≫ Linux Kernel Version >= 6.19 < 7.1.4
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.48% 0.385
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://git.kernel.org/stable/c/1426fd79102539bc0ab5c8fced047ad4313b9908
Patch
https://git.kernel.org/stable/c/2a64dbf9c739ddf7a25a066507597bf89f8f73d2
Patch
https://git.kernel.org/stable/c/64dac2d486ec1eb18dc00968b16a230b6b75ec24
Patch
https://git.kernel.org/stable/c/a1d5d31cad593ea5e1b637f2f39c9ef6d09d1199
Patch
https://git.kernel.org/stable/c/fd22b039a5a05bc1d6818e9dcd1001fb432a829d
Patch
https://git.kernel.org/stable/c/be6d26bf27499977c746abc163659915082348d8
Patch